thegentlemen
Also known as: Storm-2697First seen September 9, 2025Active816 claimed victims
The claims below are reproduced as posted by thegentlemen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| DGS | April 8, 2026 | ransomware_live | — |
| Win Academy | April 8, 2026 | ransomware_live | — |
| Mahyco Pvt | April 8, 2026 | ransomware_live | — |
| Ciarus | April 8, 2026 | ransomware_live | — |
| Hospital del Sur | April 8, 2026 | ransomware_live | — |
| Optima Servicios Financieros | April 8, 2026 | ransomware_live | — |
| ACE Consulting Engineers | April 8, 2026 | ransomware_live | — |
| Thai Special Gas | April 8, 2026 | ransomware_live | — |
| Structures Stucco | April 8, 2026 | ransomware_live | — |
| Thai Rung Union Car | April 8, 2026 | ransomware_live | — |
| Burning Rock Biotech | April 8, 2026 | ransomware_live | — |
| Metropolitan Pediatrics | April 8, 2026 | ransomware_live | — |
| Synergy France | April 8, 2026 | ransomware_live | — |
| DYSA | April 8, 2026 | ransomware_live | — |
| Gesvalt | April 8, 2026 | ransomware_live | — |
| Ravands Plastech | April 8, 2026 | ransomware_live | — |
| Test Rite | April 8, 2026 | ransomware_live | — |
| Tapon Corona | April 8, 2026 | ransomware_live | — |
| Aichi Electric | April 8, 2026 | ransomware_live | — |
| Heatherwood Golf Club | April 6, 2026 | ransomware_live | — |
| Innovision Holdings | April 5, 2026 | ransomware_live | — |
| **********.com | April 4, 2026 | ransomware_live | — |
| jrk.com | April 4, 2026 | ransomware_live | — |
| Equity Life | April 4, 2026 | ransomware_live | — |
| Zamek Namest | April 4, 2026 | ransomware_live | — |
| Dreamtoy | April 4, 2026 | ransomware_live | — |
| UCPS | April 4, 2026 | ransomware_live | — |
| Terminal 21 | April 4, 2026 | ransomware_live | — |
| Medici Group | April 4, 2026 | ransomware_live | — |
| Far East Fame | April 4, 2026 | ransomware_live | — |
| alloha.com | April 4, 2026 | ransomware_live | — |
| Gaposa | April 4, 2026 | ransomware_live | — |
| St Fabian | April 4, 2026 | ransomware_live | — |
| GCA Group | April 4, 2026 | ransomware_live | — |
| GCA Professional | April 4, 2026 | ransomware_live | — |
| Das Labor | April 4, 2026 | ransomware_live | — |
| Zanzi | April 4, 2026 | ransomware_live | — |
| AIRCOS | April 4, 2026 | ransomware_live | — |
| Jati Tinggi | March 26, 2026 | ransomware_live | — |
| Casa Andina | March 26, 2026 | ransomware_live | — |
| CH Express | March 26, 2026 | ransomware_live | — |
| Americo Advogados | March 26, 2026 | ransomware_live | — |
| Sunspray Food | March 26, 2026 | ransomware_live | — |
| Cosmo Group | March 26, 2026 | ransomware_live | — |
| SYSTHERM INFO | March 26, 2026 | ransomware_live | — |
| Sgt | March 26, 2026 | ransomware_live | — |
| Friktimporten Stockholm | March 26, 2026 | ransomware_live | — |
| Distritech | March 23, 2026 | ransomware_live | — |
| Omikenshi | March 23, 2026 | ransomware_live | — |
| Grupo Tawa | March 23, 2026 | ransomware_live | — |
| Delta Ducon Engenharia | March 23, 2026 | ransomware_live | — |
| Adaptavist Group LTD | March 23, 2026 | ransomware_live | — |
| SATS Sports Club Sweden | March 22, 2026 | ransomware_live | — |
| PTT Philippines | March 22, 2026 | ransomware_live | — |
| Groupe Caddac | March 21, 2026 | ransomware_live | — |
| Micro Leasing | March 21, 2026 | ransomware_live | — |
| Rajagiri Hospital | March 21, 2026 | ransomware_live | — |
| MEDICUS SHUPPAN | March 21, 2026 | ransomware_live | — |
| Cerio | March 19, 2026 | ransomware_live | — |
| MicroChem | March 19, 2026 | ransomware_live | — |
| Economia | March 18, 2026 | ransomware_live | — |
| Excellentiam | March 18, 2026 | ransomware_live | — |
| 2LG Prod | March 18, 2026 | ransomware_live | — |
| GPAINNOVA | March 18, 2026 | ransomware_live | — |
| Vexin Normand | March 18, 2026 | ransomware_live | — |
| BCN Medical | March 16, 2026 | ransomware_live | — |
| Chase Asia | March 16, 2026 | ransomware_live | — |
| Canal Capital | March 16, 2026 | ransomware_live | — |
| Payap University | March 16, 2026 | ransomware_live | — |
| Kabelovna Kabex | March 16, 2026 | ransomware_live | — |
| Cortporation Colina | March 16, 2026 | ransomware_live | — |
| Centro de Especialidades | March 16, 2026 | ransomware_live | — |
| Caribbean Medical Center | March 16, 2026 | ransomware_live | — |
| ControlGMC | March 12, 2026 | ransomware_live | — |
| St Fabian Catholic | March 12, 2026 | ransomware_live | — |
| Einstein Technology | March 12, 2026 | ransomware_live | — |
| Docaret | March 11, 2026 | ransomware_live | — |
| Grupo San Jacinto | March 9, 2026 | ransomware_live | — |
| Cosmesia | March 9, 2026 | ransomware_live | — |
| Sodimatel Fasteners | March 9, 2026 | ransomware_live | — |
| Kpropha | March 9, 2026 | ransomware_live | — |
| Nenplas | March 9, 2026 | ransomware_live | — |
| eDevice | March 9, 2026 | ransomware_live | — |
| Gerleinco | March 6, 2026 | ransomware_live | — |
| LAF Hotel Aree | March 6, 2026 | ransomware_live | — |
| Malia Group | March 6, 2026 | ransomware_live | — |
| Nephrology Associates | March 6, 2026 | ransomware_live | — |
| Reanthong Partcenter | March 4, 2026 | ransomware_live | — |
| Comtec 2000 | March 4, 2026 | ransomware_live | — |
| Primus | March 4, 2026 | ransomware_live | — |
| CHS Villach | March 3, 2026 | ransomware_live | — |
| Special Shapes Refractory | March 1, 2026 | ransomware_live | — |
| Labtician Ophthalmics | March 1, 2026 | ransomware_live | — |
| All India Minerals | March 1, 2026 | ransomware_live | — |
| Ricopia | March 1, 2026 | ransomware_live | — |
| Afezo | March 1, 2026 | ransomware_live | — |
| Fundao Para | February 27, 2026 | ransomware_live | — |
| Thg | February 27, 2026 | ransomware_live | — |
| Sejlstrup | February 27, 2026 | ransomware_live | — |
| Grand Hotel | February 27, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).